Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 5036] New: TShark capture file to text conversion gets malformed packets. Usin

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5036

           Summary: TShark capture file to text conversion gets malformed
                    packets. Using the same capture file I get a few
                    malformned packets. A co-worker gets many more
                    malformed packets when using the same version on a
                    similar system.
           Product: Wireshark
           Version: 1.2.9
          Platform: x86
        OS/Version: Windows XP
            Status: NEW
          Severity: Major
          Priority: Low
         Component: TShark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: ken.rains@xxxxxxxxxxx


Created an attachment (id=4938)
 --> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=4938)
original capture (4MB of 45MB) file

Build Information:
TShark 1.2.9 (SVN Rev 33171)
--
I have a capture file (.pcap). I use tshark to convert the packet pane to a
text file for analysis with a Perl script.

we are testing the Perl script to ensure it is working well with other users.
We noticed that when I send the original capture file (45MB) and a smaller
version of the original (4MB) to two other users they have different results.
Their capture to text files have many instances of malformed [oackets while
mine does not have the same frames reported as malformed.

We all start with the same capture file. we use tshark to create a text file of
the packet list pane. Using essentially the same type laptops (Windows XP Pro,
3GB memory, 2GHz clock) the tshark output files have many differences in
reported malformed packets.

I will attach the small original file (4MB) and my tshark output file with a
tshark output file from Leslie. The file names are:
- Open_ICShop_addinhandset_test_USSMakin_1st20000.pcap = original file (1st 4MB
of 45MB)
- Open_ICShop_addinhandset_test_USSMakin_1st20000txtfrKen = tshark output file
with frKen added to filename to show it was Ken's (mine)output. few malformed
packets reported in this file
- Open_ICShop_addinhandset_test_USSMakin_1st20000txtfrLes = tshark output file
with frLes added to show this is the outpur file from Les' tshark run on his
laptop.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.